Top Risks

• Free-webmail dev email (gmail) with no verified publisher or business identity — unaccountable developer.
• WhatsApp brand impersonation: dev does not own WhatsApp but uses it as primary branding trigger.
• Privacy policy not scoped to this extension and data_collection not disclosed; third-party silence.
• Content script on whatsapp.com can read/modify all chat messages; innerHTML DOM-XSS sink present with no CSP.
• Install URL hijack opens whatsapp.com on install; extremely low install count (7) warrants tail-risk scrutiny.

Evidence

• free_webmail_developer store Developer email wl.exten.05@gmail.com — free webmail, no verified business, numbered alias pattern.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, confirmed_owner=false.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com — opens 3rd-party URL on install.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false, third_party_silence=true — not scoped to extension.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in vendor.js; csp_present=false amplifies DOM-XSS risk (FIX B).
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — can access all WhatsApp Web messages.
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default but extension explicitly omits extension-level CSP.
• very_low_installs store Only 7 installs — extremely limited blast radius but tail-attack-surface concern for targeted deployment.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm on its own.
• storage low Standard key-value storage; minimal risk.
• tabs medium Can read tab URLs/titles; moderate info exposure.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify chat content.

Pillar Scores

Bookkeeping